Network virtualization

Abstract

A virtual network has virtual machines on physical devices connected to network interfaces each coupled by tunnels ( 100 ) through a forwarding network ( 40 ), each interface having a forwarding address in an address space of the forwarding network, each network interface having a reconfigurable address mapper ( 320 ) for determining a forwarding address for a packet, and encapsulating the packet with its forwarding address so that the forwarding network can deliver the data packet to the remote physical device having that forwarding address. Such encapsulation enables virtual machines on different physical devices to communicate transparently to the underlying forwarding network. Virtual networks can be created to suit their applications yet use or share existing forwarding networks, while protecting the forwarding network from interference by the virtual machines, and maintaining isolation between virtual machines.

1. A network interface for a first physical device for sending a data packet from at least one local virtual machine on the first physical device to at least one other virtual machine on at least one remote physical device, coupled by a forwarding network, the network interface comprising:
 a data packet receiver configured to receive data packets having a destination address of the at least one other virtual machine in an address space of a virtual network, independent of an address space of the forwarding network; 
 an address mapper arranged to determine a corresponding forwarding address in the address space of the forwarding network, using the destination address of each data packet, the address mapper having a stored mapping of addresses for determining the corresponding forwarding address, and the address mapper arranged to configure the stored mapping by sending a discovery request over the forwarding network in response to the address mapper not having a corresponding forwarding address for the data packet or in response to the corresponding forwarding address for the data packet being out of date; and 
 an encapsulator arranged to encapsulate each data packet with the corresponding forwarding address so that the forwarding network can deliver the data packet to the remote physical device having that corresponding forwarding address, 
 wherein the at least one local virtual machine or the at least one other virtual machine is connected to two virtual networks and has two virtual network addresses, 
 wherein a source address of each data packet is set without reference to the at least one local virtual machine, 
 wherein the corresponding address is determined according to which virtual network the data packet belongs to without reference to the at least one local virtual machine, and 
 wherein the encapsulator encapsulates each data packet with an indication of to which virtual network the data packet belongs. 
 
     
     
       2. The network interface of  claim 1 , the address mapper being arranged to determine the corresponding forwarding address locally without reference to a remote centralized map. 
     
     
       3. The network interface of  claim 1 , for use with multiple local virtual machines on the first physical device, and arranged to receive inbound encapsulated packets from the forwarding network and use the destination address of the packets to route each packet to the correct one of the local virtual machines. 
     
     
       4. The network interface of  claim 1 , for use with multiple virtual networks, the stored mapping having an input for an identifier of the virtual network. 
     
     
       5. The network interface of  claim 1 , arranged such that the at least one local virtual machine on the first physical device and the at least one other virtual machine on the at least one remote physical device are unaware of the forwarding addresses. 
     
     
       6. The network interface of  claim 1 , arranged for use with multiple virtual networks, and arranged to determine which of the multiple virtual networks the data packet belongs to without reference to the at least one local virtual machine on the first physical device and the at least one other virtual machine on the at least one remote physical device. 
     
     
       7. The network interface of  claim 1 , arranged to intercept all the data packets sent by the at least one local virtual machine. 
     
     
       8. The network interface of  claim 1 , and using an operating system to provide a bridge from the at least one local virtual machine to the interface. 
     
     
       9. The network interface of  claim 1 , the virtual network using a network standard according to ISO layer 2. 
     
     
       10. The network interface of  claim 1 , the forwarding network using a network standard according to ISO layer 3. 
     
     
       11. The network interface of  claim 1 , being arranged to initialize the stored mapping by sending a discovery request over the forwarding network. 
     
     
       12. A computer network having a first physical server arranged to run the interface of  claim 1 , and a second physical server coupled to the first physical server by a physical link, and arranged to run a remote interface, the forwarding network being arranged to use the physical link. 
     
     
       13. A computer network comprising:
 a plurality of virtual network segments; 
 at least a first and second physical server; 
 a plurality of virtual machines running on the first and second physical servers whereby at least one of the virtual machines runs on the first physical server and at least another one of the virtual machines runs on the second physical server; and 
 a network interface for sending a data packet from the at least one of the virtual machines to the at least another one of the virtual machines, the network interface comprising an address mapper arranged to determine a corresponding forwarding address in an address space of a forwarding network, using a destination address of the data packet, the address mapper having a stored mapping of addresses for determining the corresponding forwarding address, and the address mapper arranged to configure the stored mapping by sending a discovery request over the forwarding network in response to the address mapper not having a corresponding forwarding address for the data packet or in response to the corresponding forwarding address for the data packet being out of date, 
 wherein the virtual machines are adapted to exchange information over a virtual network segment on which arbitrary IP and arbitrary MAC addresses can be used, 
 wherein the at least one of the virtual machines is homed on more than one virtual network segment and has two virtual network addresses, 
 wherein a source address of the data packet is set without reference to the at least one of the virtual machines, 
 wherein the corresponding address is determined according to which virtual network the data packet belongs to without reference to the at least one of the virtual machines, and 
 wherein the data packet is encapsulated with an indication of to which virtual network the data packet belongs. 
 
     
     
       14. A computer network as claimed in  claim 13 , wherein the at least one of the virtual machines implements a virtual firewall. 
     
     
       15. A method of sending a data packet across a virtual network from a local virtual machine on a first physical device to at least one other virtual machine on at least one remote physical device, coupled by a forwarding network, the data packet having a destination address of the other virtual machine in an address space of the virtual network, independent of an address space of the forwarding network, the method having the steps of:
 determining a corresponding forwarding address in the address space of the forwarding network, using the destination address of each data packet and an address mapper; 
 determining whether there is a corresponding forwarding address for the data packet in the address mapper; 
 sending a discovery request over the forwarding network to obtain a corresponding forwarding address in response to determining that there is no corresponding forwarding address for the data packet in the address mapper; 
 receiving the corresponding forwarding address; 
 encapsulating the data packet with the corresponding forwarding address; 
 sending the encapsulated data packet over the forwarding network for delivery to the remote physical device having that corresponding forwarding address; 
 setting a source address of the data packet without reference to the local virtual machine; and 
 determining the corresponding forwarding address according to which virtual network the data packet belongs to without reference to the local virtual machine, 
 wherein encapsulating the data packet comprises encapsulating the data packet with an indication of to which virtual network the data packet belongs, and 
 wherein the local virtual machine or the at least one other virtual machine is connected to two virtual networks and has two virtual network addresses. 
 
     
     
       16. A method of sending a data packet across a virtual network from a local virtual machine on a first physical device to at least one other virtual machine on at least one remote physical device, coupled by a forwarding network, the data packet having a destination address of the other virtual machine in an address space of the virtual network, independent of an address space of the forwarding network, the method having the steps of:
 determining a corresponding forwarding address in the address space of the forwarding network, using the destination address of each data packet and an address mapper; 
 determining whether the corresponding forwarding address in the address mapper is out of date; 
 sending a discovery request over the forwarding network to obtain a corresponding forwarding address in response to determining that the corresponding forwarding address for the data packet in the address mapper is out of date; 
 receiving the corresponding forwarding address; 
 encapsulating the data-packet with the corresponding forwarding address; and 
 sending the encapsulated data packet over the forwarding network for delivery to the remote physical device having that corresponding forwarding address; 
 setting a source address of the data packet without reference to the local virtual machine; and 
 determining the corresponding address according to which virtual network the data packet belongs to without reference to the local virtual machine, 
 wherein encapsulating the data packet comprises encapsulating the data packet with an indication of to which virtual network the data packet belongs, 
 wherein the local virtual machine or the at least one other virtual machine is connected to two virtual networks and has two virtual network addresses. 
 
     
     
       17. The method of  claim 16 , wherein determining whether the corresponding forwarding address in the address mapper is out of date comprises determining whether the corresponding forwarding address in the address mapper is expired.